topic Re: How to Reset the Admin password? in Security

How to Reset the Admin password?

Lionel — Wed, 04 Nov 2020 20:39:37 GMT

I just realized that I lost the Admin password and I need a way to access the system, with my Admin credentials.

Re: How to Reset the Admin password?

matt — Wed, 24 Mar 2010 01:17:23 GMT

To reset the admin password you will need to have access to the file system:
- move the $SPLUNK_HOME/etc/passwd file to passwd.bak
- restart splunk. After the restart you should be able to login using the default login (admin/changeme).

If you created other user accounts, copy those entries from the backup file into the new passwd file and restart splunk.

Re: How to Reset the Admin password?

tirher — Mon, 29 Aug 2011 05:13:36 GMT

It´s very simple 😉

Thanks brother !!

Re: How to Reset the Admin password?

joposos — Thu, 04 Jul 2013 05:57:43 GMT

I cannot find a passwd file under $SPLUNK_HOME/etc. I'm unable to login to splunk the first time itself with admin and change me credentials

Jophy

Re: How to Reset the Admin password?

eappan — Fri, 06 Dec 2013 19:27:54 GMT

If you are installing a splunk server (search, index, deploy) likely the splunk client software is running and using the same port. You need to remove the the following file:

mv /opt/splunkforwarder/etc/passwd /opt/splunkforwarder/etc/passwd.bak

On Ubuntu
dpkg -l splunkforwarder (list the package)
dpkg -r splunkforwarder (remove the package)

Try login after, it should take admin/changeme.

Re: How to Reset the Admin password?

Junnilly — Mon, 28 Dec 2015 08:26:23 GMT

I know iSeePassword windows password recovery program can reset password for Widows 7,8 and 10.
but you need a USB or DVD.
ttp://www.iseepassword.com/how-to-reset-windows-7-password.html

Re: How to Reset the Admin password?

mspuranik — Fri, 02 Sep 2016 10:27:46 GMT

Hey, I tried this but it does not seem to work. It says wrong password upon entering 'changeme'. By 'moving' passwd to passwd.bak do you mean renaming it? (I'm using Windows OS, not using any command shell). Please help.

Re: How to Reset the Admin password?

owaisenfo — Fri, 14 Oct 2016 09:23:12 GMT

Hi, This question has been asked several times because the answer is bit confusing. It says moving passwd file to passwd.bak. What does this mean??

I can find passwd file but what is this passdw.bak? and where to find it, must be a folder where this file will be moved? Or do we have to just change the fle extension?

Please help, Thanks.

Re: How to Reset the Admin password?

bmunson_splunk — Fri, 14 Oct 2016 13:47:59 GMT

This is an old answer and only works prior to V7.1. For all other versions read cbreshears_splunk Answer

Yes. Just rename it with a .bak extension, restart and use the default password of "changeme"

Re: How to Reset the Admin password?

bpitts2 — Tue, 18 Oct 2016 13:06:11 GMT

Yes, you need to rename the file and then restart the splunk service.

Re: How to Reset the Admin password?

reddyo — Fri, 20 Jan 2017 06:14:19 GMT

JUst rename the passwd file and restart 🙂

Re: How to Reset the Admin password?

jdomin30 — Tue, 27 Jun 2017 03:07:37 GMT

I have mac, would it be the same for me?

Re: How to Reset the Admin password?

chskm — Thu, 03 Aug 2017 16:27:19 GMT

Hi Owaisenfo,

It's nothing but to rename to the passwd file to passwd.bak

Saikrishna

Re: How to Reset the Admin password?

chskm — Thu, 03 Aug 2017 16:27:46 GMT

Hi Owaisenfo,

It's nothing but to rename to the passwd file to passwd.bak

Saikrishna

Re: How to Reset the Admin password?

chippysplunk — Tue, 10 Apr 2018 04:44:06 GMT

I renamed Password file into password.bak and restarted splunk.
Still I am not able to login with "admin/changeme".

Re: How to Reset the Admin password?

Swatikeshari — Sun, 15 Apr 2018 16:02:58 GMT

I have installed splunk in my Linux Ubuntu system. I have forgot the admin password and now I am trying to retrieve it but I am not able to find the passwd file under /splunk/etc directory
Please help me on this.

Re: How to Reset the Admin password?

Swatikeshari — Sun, 15 Apr 2018 21:43:16 GMT

mv /opt/splunk/etc/passwd /opt/splunk/etc/passwd.bak
mv: cannot move '/opt/splunk/etc/passwd' to '/opt/splunk/etc/passwd.bak': Permission denied

Why I am getting this error?

Re: How to Reset the Admin password?

reddyo — Mon, 16 Apr 2018 15:41:23 GMT

Swati, You should try with root, splunk user doesn't have root permissions else add splunk user as NOPASSWD in sudoers file with root user as below and try again

vi /etc/sudoers ( with root user)

XXX ALL=(ALL) NOPASSWD:ALL here XXX is user name.

hope it should work 🙂

-Om

Re: How to Reset the Admin password?

cbreshears_splu — Tue, 29 Sep 2020 19:19:41 GMT

How to do this in 7.1 + :

Stop Splunk Enterprise
Find the passw file for your instance ($SPLUNK_HOME/etc/passwd) and rename it to passwd.bk
Create a file named user-seed.conf in your $SPLUNK_HOME/etc/system/local/ directory.
In the file add the following text:

[user_info]
PASSWORD = NEW_PASSWORD

In the place of "NEW_PASSWORD" insert the password you would like to use.
Start Splunk Enterprise and use the new password to log into your instance from Splunk Web.
If you previously created other users and know their login details, copy and paste their credentials from the passwbk file into the passwd file and restart Splunk.

Versions prior to 7.1 :

Stop Splunk Enterprise
Find the passw file for your instance ($SPLUNK_HOME/etc/passw) and rename it to passw.bk
Start Splunk Enterprise and login to your instance from Splunk Web using the default credentials of admin/changeme.
You will be asked to enter a new password for your admin account.
If you previously created other users and know their login details, copy and paste their credentials from the passw.bk file into the passwd file and restart Splunk.

Re: How to Reset the Admin password?

amielke — Wed, 02 May 2018 12:08:59 GMT

Hi,

I've read the steps, but unfortunately I don't want it that way. I renamed the passwd file, rebooted the system. I still can't login with admin and changeme. Splunk does not create a new passwd file for me either. There is also no standard initial login screen with admin and changeme.
Anybody have an idea?